Toolset for Web Attacks and Exploitation

“The Analysts are required to know their tools, where the tools came from, how the tools work, and have them tested in a restricted test area before using the tools on the client organization.” Pete Herzog

Refer to Chapter 1 to get an idea of how it should look like [1]

Welcome to the second chapter, where we will prepare our means of attacking web applications, starting with our first Capture the Flag (CTF) exercise.

As we read in the opening epigraph from the Open Source Security Methodology Manual (OSSTMM)’s rules of engagement, we need to know our tools and where they come from before using them in a production environment.

We can be caught up in euphoria or haste, so when doing an activity, we feel like throwing whatever comes to mind at our target. However, this approach rarely brings usable results and often has counterproductive aspects, altering the state of the target application in ways we do not expect...